--- title: binwalk — Security analysis and diagnostics date: 2026-10-18 time: 12:00 model: admin category: programs author_type: human summary: An analysis tool that scans firmware/disk images for embedded compression, filesystems, and signatures to reveal internal structure. v3 was rewritten in Rust. tags: program, Security analysis and diagnostics, binwalk --- An analysis tool that identifies filesystems and files contained within firmware and disk images. ## Basic Information | Program name | binwalk | | --- | --- | | One-line summary | An analysis tool that identifies filesystems and files contained within firmware and disk images. | | Developed and maintained by | ReFirmLabs | | Official homepage | https://github.com/ReFirmLabs/binwalk | | Official documentation | https://github.com/ReFirmLabs/binwalk#readme | | Official download | https://github.com/ReFirmLabs/binwalk/releases | | Supported operating systems | Linux, macOS, Windows (v3 is Rust-based) | | License | MIT | | Stable version | 3.1.0 (released 2024-10-31, rewritten in Rust) — checked on 2026-10-18 | | GitHub repository | https://github.com/ReFirmLabs/binwalk | | Category | Security analysis and diagnostics (tags: firmware analysis, filesystem, signature scan) | ## What is this program? binwalk is a tool that uses signature scanning to find filesystems, compressed blocks, certificates, and more inside router and IoT device firmware or disk image binaries. It is widely used as a first step when trying to understand what is inside a firmware file. Version 3, released in 2024, was completely rewritten in Rust with improvements in speed and reduced false positives. ## What problems does it solve? - When you need to understand the internal structure of IoT and network device firmware. - When you need to check which partitions and filesystems are used in a disk image. - When you need to find hidden compressed blocks, certificates, scripts, etc. inside files. - When you need to verify during a security review that distributed binaries do not contain unexpected files. ## Key features ### Signature scanning Marks potential file boundaries by comparing known magic bytes and signatures within the binary. - **Use case**: Scans the entire firmware image. - **Result**: Produces a list showing what type (compression, filesystem, etc.) may be present at each offset. - **Limitations**: Because it is signature-based, false positives can occur, and v2 and v3 output formats differ. ### File extraction Extracts and decompresses identified blocks into actual files (expanded in v3). - **Use case**: Used to analyze extracted root filesystem strings and configuration files. - **Result**: Obtains contained busybox, configuration files, etc. - **Limitations**: Damaged blocks may fail to decompress. ### Entropy analysis Calculates the information entropy of binary regions to visually distinguish compressed and encrypted sections. - **Use case**: See where plaintext and encrypted blocks begin. - **Result**: Estimates section boundaries from the entropy curve. - **Limitations**: Entropy alone cannot determine exact file types. ### Docker and cross-platform support v3 officially provides a Dockerfile and Windows builds. - **Use case**: Used by teams that need to keep analysis environments consistent. - **Result**: Creates a reproducible analysis environment with containers. - **Limitations**: No GUI, so post-processing of extracted results requires separate tools. ## Installation and execution ### pip (v3) Rust-based v3 builds from source from the repository. Requires cargo. ``` git clone https://github.com/ReFirmLabs/binwalk cd binwalk cargo install --path . ``` ### Ubuntu / Debian (v2 repository version) The distribution repository version may be from the v2 series. ``` sudo apt update sudo apt install binwalk ``` ### Docker Create a container environment using the Dockerfile from the official repository. ``` # Refer to the repository Dockerfile: https://github.com/ReFirmLabs/binwalk ``` ## Practical usage examples ### Basic scan Scans a firmware file and lists structures that may be contained in it. ``` binwalk firmware.bin ``` ### File extraction Extracts identified items into an extraction directory. (v3 as reference, output is an example) ``` binwalk -e firmware.bin ``` ### Entropy analysis Draws an entropy curve to estimate compression and encryption. ``` binwalk -E firmware.bin ``` ## Pros and cons ### Advantages - Allows the fastest overall structure assessment during initial firmware and image investigation. - MIT license allows free commercial use. - v3 is Rust-based, faster than before, and has fewer false positives. - CLI makes it easy to integrate into scripts and automation pipelines. ### Considerations before use - Because it is signature-based, the results must not be fully trusted and require follow-up verification. - Compared to GUI reversing tools, its in-depth analysis capabilities are limited. - Distribution repository versions may still be v2, so checking the official repository is necessary. - Security validation of extracted files is the user's responsibility (beware of malicious images). ## Comparison with similar programs | Program | Features | Suitable when | | --- | --- | --- | | firmware-mod-kit | A tool suite focused on firmware extraction and reassembly. | When you need to repackage after extraction. | | jefferson | Extracts only JFFS2 filesystems professionally. | When the goal is JFFS2 image analysis. | | file·xxd | Basic tools for simple magic byte identification and hex viewing. | When you only need to quickly check the display of small files. | ## Official resources and further learning - [Official homepage](https://github.com/ReFirmLabs/binwalk) — https://github.com/ReFirmLabs/binwalk - [Official documentation / knowledge base](https://github.com/ReFirmLabs/binwalk#readme) — https://github.com/ReFirmLabs/binwalk#readme - [Official download](https://github.com/ReFirmLabs/binwalk/releases) — https://github.com/ReFirmLabs/binwalk/releases - [Release notes](https://github.com/ReFirmLabs/binwalk/releases) — https://github.com/ReFirmLabs/binwalk/releases - [Source / development resources](https://github.com/ReFirmLabs/binwalk) — https://github.com/ReFirmLabs/binwalk Version and supported environment information is based on values confirmed on the official site as of 2026-10-18. Installation commands may vary depending on your distribution and version, so please also check the official installation documentation. ## Actual execution screen This is a synthetic example of a binwalk signature scan result recreated in a server-like style. The screen is a composite example and not actual execution output. ![binwalk firmware scan result: screen showing uImage header, LZMA compression, and Squashfs filesystem offsets](https://games.aidebatehub.com/assets/binwalk-demo.png) Actual production server --- Source (HTML): https://games.aidebatehub.com/programs/apps/security/binwalk.html This file is an auto-generated Markdown twin of the DevHub document.